@push.rocks/smartmta 13.0.0 → 13.0.2

package/changelog.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 2026-11-01 - 13.0.2
+
+### Fixes
+
+- DKIM signing now over-signs From, Reply-To, Subject, To, Cc, Date, Message-ID, MIME-Version and Content-Type (one `h=` entry more than the instances present, so an added or duplicated field fails verification) and also signs In-Reply-To, References, Resent-Date, Resent-From, Resent-Sender, Resent-To, Resent-Cc, Resent-Message-ID and List-* when present; every signature's `h=` therefore differs from earlier releases, and verifiers need no change.
+
+### Maintenance
+
+- The release tooling moves from the deprecated `@git.zone/tsbuild`, `@git.zone/tstest` and `@git.zone/tsrust` to `@git.zone/tsrepo` ^1.1.1 (`tsrepo build`, `tsrepo check`, `tsrepo test`; tests import `@git.zone/tsrepo/tapbundle`) and `@git.zone/rsrepo` ^1.1.1 (`rsrepo`, `rsrepo verify`, `rsrepo notices`; the `.smartconfig.json` key is now `@git.zone/rsrepo`); `@git.zone/cli` ^12.0.1, `@types/node` ^26.6.5 and pnpm 12.15.0.
+
+## 2026-10-15 - 13.0.1
+
+### Fixes
+
+- Inbound SMTP DATA keeps the CRLF that ends the message's last line (RFC 5321 §4.1.1.4: the first CRLF of `<CRLF>.<CRLF>` belongs to the message); since 5220ee0 the Rust DATA reader removed it as part of the terminator. The `rawMessage` handed to `onAcceptEnvelope`/`onMessageData` gains those two bytes and is now the exact received message (dot-stuffing removed), so received mail can be passed unchanged to `sendRawEmail({ signing: 'unsignedRelay' })`, `sendRawOutboundEmail()` and `enqueueRawEmail()`, which refused it before for a missing final CRLF. DKIM, SPF and DMARC verdicts, parsed `Email` fields and the SIZE limit are unchanged. Consumers that appended a CRLF themselves must stop (CoreMail).
+- A message larger than `maxMessageSize` is now read to its end-of-data marker and then refused with 552, and the session continues. Before, the 552 was sent as soon as the limit was crossed and the rest of the message was read as SMTP commands, so lines in an oversized body (`RSET`, `MAIL FROM`, `RCPT TO`, `DATA` and a further message) were executed.
+- Commands pipelined behind the end-of-data marker in the same segment (RFC 2920), such as `.<CRLF>QUIT<CRLF>` or the next transaction's `MAIL FROM`/`RCPT TO`/`DATA`, are answered in order. Before, the DATA reader discarded every byte after the marker in the chunk it had read, and the client waited for replies that never came.
+
 ## 2026-10-15 - 13.0.0
 
 ### Breaking Changes

package/dist_rust/mailer-bin_linux_amd64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "f8dab1778aa8426956cec532226ea2f30c2d5a87e4b469b6c7d4c1b2ab6f6fdd",
+  "binarySha256": "5ced0f2fb1fbb6c79a653ff4df450da297eca2e3b2fa1d984a3f7bec689512ac",
   "buildInfo": {
     "projectName": "@push.rocks/smartmta",
-    "projectVersion": "13.0.0",
-    "gitCommit": "703440756f7b7b48e0ae105d94fa393c91318e72",
+    "projectVersion": "13.0.2",
+    "gitCommit": "32839c1c9878eac237541811a805265d1abffb7f",
     "gitDirty": false,
-    "builtAt": "2026-10-15T10:07:12.782Z",
-    "tsrustVersion": "4.6.0",
+    "builtAt": "2026-11-01T15:23:01.857Z",
+    "tsrustVersion": "1.1.1",
     "binary": "mailer-bin",
     "target": "linux_amd64_musl"
   }

package/dist_rust/mailer-bin_linux_arm64_musl.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "1cc0210225bf2b5d9d501e7a126a178cec8617fe0f7c23acd54d0dc96f8adee0",
+  "binarySha256": "3cb3e0bda579449bcb6fe637f484967cb0d2f4021bb270cb585e1df02dea4836",
   "buildInfo": {
     "projectName": "@push.rocks/smartmta",
-    "projectVersion": "13.0.0",
-    "gitCommit": "703440756f7b7b48e0ae105d94fa393c91318e72",
+    "projectVersion": "13.0.2",
+    "gitCommit": "32839c1c9878eac237541811a805265d1abffb7f",
     "gitDirty": false,
-    "builtAt": "2026-10-15T10:09:24.772Z",
-    "tsrustVersion": "4.6.0",
+    "builtAt": "2026-11-01T15:26:11.899Z",
+    "tsrustVersion": "1.1.1",
     "binary": "mailer-bin",
     "target": "linux_arm64_musl"
   }

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartmta',
-    version: '13.0.0',
+    version: '13.0.2',
     description: 'A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHlIQUF5SDtDQUN2SSxDQUFBIn0=

package/dist_ts/security/classes.rustsecuritybridge.d.ts

@@ -406,7 +406,7 @@ export declare class RustSecurityBridge extends EventEmitter {
     private _deliberateStop;
     private _smtpServerConfig;
     /**
-     * Map Node.js process.platform / process.arch to the tsrust target suffix
+     * Map Node.js process.platform / process.arch to the rsrepo target suffix
      * of the shipped binaries. Linux binaries are static musl builds, e.g.
      * mailer-bin_linux_amd64_musl.
      */

package/dist_ts/security/classes.rustsecuritybridge.js

@@ -239,7 +239,7 @@ export class RustSecurityBridge extends EventEmitter {
     _deliberateStop = false;
     _smtpServerConfig = null;
     /**
-     * Map Node.js process.platform / process.arch to the tsrust target suffix
+     * Map Node.js process.platform / process.arch to the rsrepo target suffix
      * of the shipped binaries. Linux binaries are static musl builds, e.g.
      * mailer-bin_linux_amd64_musl.
      */
@@ -257,7 +257,7 @@ export class RustSecurityBridge extends EventEmitter {
         super();
         const suffix = RustSecurityBridge.getPlatformSuffix();
         const localPaths = [];
-        // dist_rust/ candidates (tsrust cross-compiled output)
+        // dist_rust/ candidates (rsrepo cross-compiled output)
         if (suffix) {
             localPaths.push(plugins.path.join(paths.packageDir, 'dist_rust', `mailer-bin_${suffix}`));
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartmta",
-  "version": "13.0.0",
+  "version": "13.0.2",
   "description": "A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.",
   "keywords": [
     "mta",
@@ -31,11 +31,10 @@
     ".": "./dist_ts/index.js"
   },
   "devDependencies": {
-    "@git.zone/cli": "^9.1.0",
-    "@git.zone/tsbuild": "^6.0.2",
-    "@git.zone/tsrust": "^4.6.0",
-    "@git.zone/tstest": "^8.0.0",
-    "@types/node": "^26.6.4",
+    "@git.zone/cli": "^12.0.1",
+    "@git.zone/rsrepo": "^1.1.1",
+    "@git.zone/tsrepo": "^1.1.1",
+    "@types/node": "^26.6.5",
     "tsx": "^4.23.15"
   },
   "dependencies": {
@@ -69,10 +68,10 @@
     "access": "public"
   },
   "scripts": {
-    "test": "tstest test/ --logfile --verbose --timeout 60",
+    "test": "tsrepo test test/ --logfile --verbose --timeout 60",
     "test:rust": "cd rust && cargo test",
-    "build": "tsbuild tsfolders && tsrust",
-    "build:release": "(tsbuild tsfolders) && (tsrust --configured-targets) && (tsrust verify)",
-    "check": "tsbuild check"
+    "build": "tsrepo build tsfolders && rsrepo",
+    "build:release": "(tsrepo build tsfolders) && (rsrepo --configured-targets) && (rsrepo verify)",
+    "check": "tsrepo check"
   }
 }

package/readme.md

@@ -270,7 +270,7 @@ const emailServer = new UnifiedEmailServer(dcRouterRef, {
     storageManager: smartBucketBlobStorage,
   },
 
-  maxMessageSize: 25 * 1024 * 1024, // 25 MB
+  maxMessageSize: 25 * 1024 * 1024, // 25 MB; a larger message is read to its end and refused with 552
   maxClients: 500,
 });
 
@@ -353,9 +353,9 @@ Without this, an authenticated submission addressed to a domain this server host
 
 `hooks.onRcptTo`, `hooks.onMessageData`, and `hooks.onAcceptEnvelope` are awaited asynchronously. If a hook throws or times out, SmartMTA returns a temporary SMTP failure. The hook context includes `abortSignal`; long-running consumers should observe it and stop work promptly. A custom `onRcptTo` hook may accept local recipients using application-specific lookup, but external relay is still blocked unless a matched route explicitly sets `allowRelay: true`.
 
-`hooks.onMessageData` runs after `DATA` and before the final SMTP response — but only for envelopes with **no** resolved `store` or `deliver` action; terminal local deliveries go through `hooks.onAcceptEnvelope` instead and never invoke `onMessageData`. Return `{ accepted: true }` only after your application has accepted responsibility for the message, such as after durable persistence. Set `continueProcessing: false` when the consumer owns all downstream processing.
+`hooks.onMessageData` runs after `DATA` and before the final SMTP response — but only for envelopes with **no** resolved `store` or `deliver` action; terminal local deliveries go through `hooks.onAcceptEnvelope` instead and never invoke `onMessageData`. Its `rawMessage` holds the same exact received bytes as in `hooks.onAcceptEnvelope`, final CRLF included. Return `{ accepted: true }` only after your application has accepted responsibility for the message, such as after durable persistence. Set `continueProcessing: false` when the consumer owns all downstream processing.
 
-`hooks.onAcceptEnvelope` is the terminal durable owner for any envelope containing a resolved `store` or `deliver` action. It receives the exact raw RFC822 bytes (`rawMessage`), the complete per-recipient route resolution (`resolvedRecipientRoutes`), and the Rust security verdicts (`securityResults`). It must durably persist the message before resolving — the SMTP `250` is only sent after the hook resolves. Throwing an `AcceptEnvelopeRejectionError` with a `5xx` code rejects the envelope permanently with that status; any other error or a `smtp.messageAcceptanceTimeoutMs` timeout refuses the envelope with a temporary `451`. Use `createAcceptedEnvelopeDispatchPlan()` inside the hook to snapshot the resolved plan for later replay-safe `dispatchAcceptedEnvelope()` calls. Both `AcceptEnvelopeRejectionError` and `IAcceptEnvelopeContext` are exported.
+`hooks.onAcceptEnvelope` is the terminal durable owner for any envelope containing a resolved `store` or `deliver` action. It receives the exact raw RFC822 bytes (`rawMessage`): the message as the client sent it, with only the DATA dot-stuffing removed and the CRLF that ends the last line kept (RFC 5321 §4.1.1.4: the first CRLF of `<CRLF>.<CRLF>` belongs to the message), so the bytes can be relayed unchanged through `enqueueRawEmail()`, `sendRawOutboundEmail()` or an unsigned raw relay. It also receives the complete per-recipient route resolution (`resolvedRecipientRoutes`), and the Rust security verdicts (`securityResults`). It must durably persist the message before resolving — the SMTP `250` is only sent after the hook resolves. Throwing an `AcceptEnvelopeRejectionError` with a `5xx` code rejects the envelope permanently with that status; any other error or a `smtp.messageAcceptanceTimeoutMs` timeout refuses the envelope with a temporary `451`. Use `createAcceptedEnvelopeDispatchPlan()` inside the hook to snapshot the resolved plan for later replay-safe `dispatchAcceptedEnvelope()` calls. Both `AcceptEnvelopeRejectionError` and `IAcceptEnvelopeContext` are exported.
 
 Use `smtp.securePort` when the implicit TLS listener uses a remapped backend port instead of public `465`; the configured secure port must also be present in `ports`, otherwise `start()` throws.
 
@@ -564,7 +564,7 @@ The `sendOutboundEmail` method:
 
 `sendRawOutboundEmail(host, port, rawMessage, envelope, { dkimDomain, dkimSelector })` provides the same transport behavior for exact bytes. It accepts only canonical CRLF-terminated message bytes and a canonical separate SMTP envelope, requires `dkimDomain` to equal the envelope sender domain, and loads the exact caller-supplied selector. It fails before SMTP if that selector/key cannot be loaded or Rust cannot sign the decoded bytes.
 
-Unsigned raw relay exists for one caller: a backup MX that holds mail received for a protected domain while its primary is down and later relays the received bytes to the primary unchanged. It cannot sign third parties' mail and must not re-sign it. It is off unless requested explicitly through the Rust bridge, `RustSecurityBridge.getInstance().sendRawEmail({ ...transport, envelopeFrom, envelopeTo, rawMessageBase64, signing: 'unsignedRelay' })`, and such a request must carry no `dkim` material; Rust refuses a request that mixes the two, names an unknown `signing` mode, or omits `dkim` without the opt-in. Authenticated submission, route actions, `sendRawOutboundEmail()`, the durable raw queue and configuration can never select it: those paths always send `signing: 'dkim'` with their resolved key. The relayed bytes go out byte for byte, so they keep the original sender's own `DKIM-Signature` and smartmta adds none; an empty `envelopeFrom` relays a bounce as `MAIL FROM:<>`, and an `outboundAuthenticationCaptureId` still captures the exact relayed bytes. The bytes must use canonical CRLF line endings and end with CRLF: Rust refuses a bare LF or CR, or a missing final CRLF, before SMTP with `errorType: 'raw_message'` and `retryable: false`, and a relay must treat that refusal as permanent because retrying the same stored bytes cannot succeed. `smartMtaCapabilities.explicitUnsignedRawRelay` advertises the option.
+Unsigned raw relay exists for one caller: a backup MX that holds mail received for a protected domain while its primary is down and later relays the received bytes to the primary unchanged. It cannot sign third parties' mail and must not re-sign it. It is off unless requested explicitly through the Rust bridge, `RustSecurityBridge.getInstance().sendRawEmail({ ...transport, envelopeFrom, envelopeTo, rawMessageBase64, signing: 'unsignedRelay' })`, and such a request must carry no `dkim` material; Rust refuses a request that mixes the two, names an unknown `signing` mode, or omits `dkim` without the opt-in. Authenticated submission, route actions, `sendRawOutboundEmail()`, the durable raw queue and configuration can never select it: those paths always send `signing: 'dkim'` with their resolved key. The relayed bytes go out byte for byte, so they keep the original sender's own `DKIM-Signature` and smartmta adds none; an empty `envelopeFrom` relays a bounce as `MAIL FROM:<>`, and an `outboundAuthenticationCaptureId` still captures the exact relayed bytes. Bytes received by the SMTP listener end with the CRLF of their last line, so a message whose sender used CRLF line endings only relays unchanged. The bytes must use canonical CRLF line endings and end with CRLF: Rust refuses a bare LF or CR, or a missing final CRLF, before SMTP with `errorType: 'raw_message'` and `retryable: false`, and a relay must treat that refusal as permanent because retrying the same stored bytes cannot succeed. `smartMtaCapabilities.explicitUnsignedRawRelay` advertises the option.
 
 When a connection proxy returns `sourceEvidence`, successful results and
 `SmtpDeliveryError` instances carry a non-enumerable
@@ -912,7 +912,7 @@ Performance-critical operations are implemented in Rust and communicate with the
 | `mailer-smtp` | Complete | Full SMTP protocol engine — TCP/TLS server + client, STARTTLS, AUTH, pipelining, connection pooling, in-process security pipeline |
 | `mailer-bin` | Complete | CLI + smartrust IPC bridge — wires everything together |
 
-`RustSecurityBridge` finds `mailer-bin` in the package's `dist_rust/` (or a local `rust/target` build). Inside a Node.js single executable application (built with `@git.zone/tssea`), smartrust runs the sidecar the executable embeds under the name `mailer-bin` instead and searches nothing else; a sidecar the executable cannot provide makes `start()` resolve `false`, and background restarts look it up again.
+`RustSecurityBridge` finds `mailer-bin` in the package's `dist_rust/` (or a local `rust/target` build). Inside a Node.js single executable application (built with `tsrepo sea` from `@git.zone/tsrepo`), smartrust runs the sidecar the executable embeds under the name `mailer-bin` instead and searches nothing else; a sidecar the executable cannot provide makes `start()` resolve `false`, and background restarts look it up again.
 
 The shipped Linux binaries are static musl executables. The SMTP client connects with `TcpStream::connect("host:port")` (`rust/crates/mailer-smtp/src/client/connection.rs`), so a host name it connects to (an MX or smarthost name, or a `connect_host`) is looked up through the C library, which is musl: only `/etc/hosts` and `/etc/resolv.conf` are consulted, and no NSS modules (`nsswitch.conf`, systemd-resolved's NSS module, LDAP and the like) take part. The SPF, DKIM, DMARC and DNSBL lookups use the hickory resolver instead.
 
@@ -968,10 +968,10 @@ pnpm run build
 pnpm test
 
 # Run specific test files
-tstest test/test.e2e.server-lifecycle.node.ts --verbose --timeout 60
-tstest test/test.e2e.inbound-smtp.node.ts --verbose --timeout 60
-tstest test/test.e2e.routing-actions.node.ts --verbose --timeout 60
-tstest test/test.e2e.outbound-delivery.node.ts --verbose --timeout 60
+pnpm exec tsrepo test test/test.e2e.server-lifecycle.node.ts --verbose --timeout 60
+pnpm exec tsrepo test test/test.e2e.inbound-smtp.node.ts --verbose --timeout 60
+pnpm exec tsrepo test test/test.e2e.routing-actions.node.ts --verbose --timeout 60
+pnpm exec tsrepo test test/test.e2e.outbound-delivery.node.ts --verbose --timeout 60
 ```
 
 **E2E tests** exercise the full pipeline — starting `UnifiedEmailServer`, connecting via raw TCP sockets, sending SMTP transactions, verifying routing actions, and testing outbound delivery through a mock SMTP receiver.
@@ -1009,15 +1009,15 @@ third-party works too.
 
 Every binary carries its notices beside it in `dist_rust/`:
 `mailer-bin_<target>.third-party-notices.json` and `.txt`, in the format that
-[`@git.zone/tssea`](https://code.foss.global/git.zone/tssea) merges into a
+[`@git.zone/tsrepo`](https://code.foss.global/git.zone/tsrepo)'s `sea` build merges into a
 single executable application. Keep that pair with any separately distributed
-copy of a `mailer-bin` executable. `@git.zone/tsrust` projects them from the
+copy of a `mailer-bin` executable. [`@git.zone/rsrepo`](https://code.foss.global/git.zone/rsrepo) projects them from the
 committed `native-notices/` directory, which ships in the npm package as well.
-`tsrust notices` generates that directory from `rust/Cargo.lock`, the toolchain
+`rsrepo notices` generates that directory from `rust/Cargo.lock`, the toolchain
 pinned in `rust-toolchain.toml` and the `notices` overrides in `.smartconfig.json`
 (reviewed project texts live in `legal/`); every build checks it and
-`tsrust verify` checks the release binaries' notices. Regenerate it with
-`pnpm exec tsrust notices` after any change to the Cargo graph, the toolchain or
+`rsrepo verify` checks the release binaries' notices. Regenerate it with
+`pnpm exec rsrepo notices` after any change to the Cargo graph, the toolchain or
 the targets, and review the diff.
 
 ## License and Legal Information

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartmta',
-  version: '13.0.0',
+  version: '13.0.2',
   description: 'A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.'
 }

package/ts/security/classes.rustsecuritybridge.ts

@@ -785,7 +785,7 @@ export class RustSecurityBridge extends EventEmitter {
   private _smtpServerConfig: ISmtpServerConfig | null = null;
 
   /**
-   * Map Node.js process.platform / process.arch to the tsrust target suffix
+   * Map Node.js process.platform / process.arch to the rsrepo target suffix
    * of the shipped binaries. Linux binaries are static musl builds, e.g.
    * mailer-bin_linux_amd64_musl.
    */
@@ -804,7 +804,7 @@ export class RustSecurityBridge extends EventEmitter {
     const suffix = RustSecurityBridge.getPlatformSuffix();
     const localPaths: string[] = [];
 
-    // dist_rust/ candidates (tsrust cross-compiled output)
+    // dist_rust/ candidates (rsrepo cross-compiled output)
     if (suffix) {
       localPaths.push(plugins.path.join(paths.packageDir, 'dist_rust', `mailer-bin_${suffix}`));
     }